From: Tom Lane <tgl@sss.pgh.pa.us>
To: Jonathan S. Katz <jkatz@postgresql.org>
Cc: Peter Eisentraut <peter.eisentraut@2ndquadrant.com>
Cc: pgsql-hackers <pgsql-hackers@postgresql.org>
Cc: Noah Misch <noah@leadboat.com>
Cc: Magnus Hagander <magnus@hagander.net>
Subject: Re: initdb recommendations
Date: Thu, 23 May 2019 22:28:27 -0400
Message-ID: <10093.1558664907@sss.pgh.pa.us> (raw)
In-Reply-To: <9f46f065-ca80-f637-8c5d-a9877bcd5eab@postgresql.org>
References: <bec17f0a-ddb1-8b95-5e69-368d9d0a3390@postgresql.org>
<f27d3170-76cf-4afb-1e1a-b1059295ec8d@2ndquadrant.com>
<CABUevExMizVYea9zaHBte66u9KipEgfwcsaE9spfqK9iYRST_g@mail.gmail.com>
<20190406180839.GA1921989@rfd.leadboat.com>
<96389374-9454-d26d-6f79-7c7b15ec14bd@2ndquadrant.com>
<81b36e8b-e27b-ab5d-c4f0-6493771bc0ee@postgresql.org>
<9f46f065-ca80-f637-8c5d-a9877bcd5eab@postgresql.org>
"Jonathan S. Katz" <jkatz@postgresql.org> writes:
> For now I have left in the password based method to be scram-sha-256 as
> I am optimistic about the support across client drivers[1] (and FWIW I
> have an implementation for crystal-pg ~60% done).
> However, this probably means we would need to set the default password
> encryption guc to "scram-sha-256" which we're not ready to do yet, so it
> may be moot to leave it in.
> So, thinking out loud about that, we should probably use "md5" and once
> we decide to make the encryption method "scram-sha-256" by default, then
> we update the recommendation?
Meh. If we're going to break things, let's break them. Set it to
scram by default and let people who need to cope with old clients
change the default. I'm tired of explaining that MD5 isn't actually
insecure in our usage ...
regards, tom lane
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-docs@postgresql.org
Cc: tgl@sss.pgh.pa.us, jkatz@postgresql.org, peter.eisentraut@2ndquadrant.com, pgsql-hackers@postgresql.org, noah@leadboat.com, magnus@hagander.net
Subject: Re: initdb recommendations
In-Reply-To: <10093.1558664907@sss.pgh.pa.us>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox